CLAIMS 

What is claimed is: 

1 . A method of detecting a computer malware comprising the steps of: 
joining an Internet Relay Chat server; 

retrieving a list of channels of the Internet Relay Chat server; 
monitoring at least one channel in the list of retrieved channels; 
accepting data received from the monitored channel; and 
storing and logging the data received from the monitored channel 

2. The method of claim 1, wherein the monitoring step comprises the steps 
of: 

joining a channel; 
waiting a time delay; and 
leaving the channel. 

3. The method of claim 2, wherein the monitoring step further comprises the 
step of: 

simulating user activities. 
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1 4. The method of claim 3, wherein the simulating step comprises the step of: 

2 transmitting a message to the channel. 

1 5 . The method of claim 1 , further comprising the step of: 

2 scanning the received data to detect a computer malware. 

1 6. The method of claim 5, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 7. The method of claim 1 , farther comprising the step of: 

2 analyzing the stored and logged data to detect a computer malware. 

1 8. The method of claim 7, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 9. The method of claim 7, further comprising the step of: 

2 scanning the received data to detect a computer malware. 
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10. The method of claim 9, wherein the computer malware comprises at least 
one of a computer virus, a computer worm, or a computer Trojan horse program. 
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1 1 . The method of claim 7, wherein the monitoring step comprises the steps 
of: 

joining a channel; 
waiting a time delay; and 
leaving the channel. 

12. The method of claim 11, wherein the monitoring step further comprises 
the step of: 

simulating user activities. 

13. The method of claim 12, wherein the simulating step comprises the step 
of: 

transmitting a message to the channel. 

14. The method of claim 13, wherein the computer malware comprises at 
least one of a computer virus, a computer worm, or a computer Trojan horse 
program. 
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1 15. A system for detecting a computer malware comprising: 

2 a processor operable to execute computer program instructions; 

3 a memory operable to store computer program instructions executable 

4 by the processor; and 

5 computer program instructions stored in the memory and executable to 

6 perform the steps of: 

7 joining an Internet Relay Chat server; 

8 retrieving a list of channels of the Internet Relay Chat server; 

9 monitoring at least one channel in the list of retrieved channels; 

1 0 accepting data received from the monitored channel; and 

1 1 storing and logging the data received from the monitored channel. 



1 16. The system of claim 15, wherein the monitoring step comprises the steps 

2 of: 

3 joining a channel; 

4 waiting a time delay; and 

5 leaving the channel. 
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1 17. The system of claim 1 6, wherein the monitoring step further comprises the 

2 step of: 

3 simulating user activities. 

1 18. The system of claim 17, wherein the simulating step comprises the step 

2 of: 

3 transmitting a message to the channel. 

1 19. The system of claim 1 5, further comprising the step of: 

2 scanning the received data to detect a computer malware. 

1 20. The system of claim 19, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 21. The system of claim 1 5 , further comprising the step of: 

2 analyzing the stored and logged data to detect a computer malware. 

1 22. The system of claim 2 1 , wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 
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1 23 . The system of claim 2 1 , further comprising the step of: 

2 scanning the received data to detect a computer malware. 

1 24, The system of claim 23, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 25. The system of claim 21, wherein the monitoring step comprises the steps 

2 of: 

ffi 3 joining a channel; 

4 waiting a time delay; and 

5 leaving the channel. 



1 26. The system of claim 25, wherein the monitoring step further comprises the 

2 step of: 

3 simulating user activities. 

1 27. The system of claim 26, wherein the simulating step comprises the step 

2 of: 

3 transmitting a message to the channel. 
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28. The system of claim 27, wherein the computer malware comprises at least 
one of a computer virus, a computer worm, or a computer Trojan horse program. 



1 29. A computer program product for detecting a computer malware 

2 comprising: 

3 a computer readable medium; 

4 computer program instructions, recorded on the computer readable 

5 medium, executable by a processor, for performing the steps of 

6 joining an Internet Relay Chat server; 

7 retrieving a list of channels of the Internet Relay Chat server; 

8 monitoring at least one channel in the list of retrieved channels; 

9 accepting data received from the monitored channel; and 

1 0 storing and logging the data received from the monitored channel. 

1 30. The computer program product of claim 29, wherein the monitoring step 

2 comprises the steps of: 

3 joining a channel; 

4 waiting a time delay; and 

5 leaving the channel. 
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31. The computer program product of claim 30, wherein the monitoring step 
further comprises the step of: 

simulating user activities. 



1 32. The computer program product of claim 31, wherein the simulating step 

2 comprises the step of: 

3 transmitting a message to the channel. 

1 33. The computer program product of claim 29, further comprising the step 

2 of: 

3 scanning the received data to detect a computer malware. 

1 34. The computer program product of claim 33, wherein the computer 

2 malware comprises at least one of a computer virus, a computer worm, or a 

3 computer Trojan horse program. 

1 35. The computer program product of claim 29, further comprising the step 

2 of: 

3 analyzing the stored and logged data to detect a computer malware. 
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36. The computer program product of claim 35, wherein the computer 
malware comprises at least one of a computer virus, a computer worm, or a 
computer Trojan horse program. 

37. The computer program product of claim 35, further comprising the step 
of: 

scanning the received data to detect a computer malware. 

38. The computer program product of claim 37, wherein the computer 
malware comprises at least one of a computer virus, a computer worm, or a 
computer Trojan horse program. 

39. The computer program product of claim 35, wherein the monitoring step 
comprises the steps of: 

joining a channel; 
waiting a time delay; and 
leaving the channel. 
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40. The computer program product of claim 39, wherein the monitoring step 
further comprises the step of: 

simulating user activities. 



1 41. The computer program product of claim 40, wherein the simulating step 

2 comprises the step of: 

3 transmitting a message to the channel. 

1 42. The computer program product of claim 41, wherein the computer 

2 malware comprises at least one of a computer virus, a computer worm, or a 

3 computer Troj an horse program. 

1 43. A system for detecting computer malwares comprising: 

2 a processor operable to execute computer program instructions; 

3 a memory accessible by the processor, the memory comprising: 

4 at least one Internet Relay Chat client operable to detect a 

5 computer malware in an Internet Relay Chat channel; and 

6 storage operable to store data received by the Internet Relay Chat 

7 client. 
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1 44. The system of claim 43 , wherein the Internet Relay Chat client is 

2 operable to detect a computer malware by performing the steps of: 

3 joining an Internet Relay Chat server; 

4 retrieving a list of channels of the Internet Relay Chat server; 

5 monitoring at least one channel in the list of retrieved channels; 

6 accepting data received from the monitored channel; and 

7 storing and logging the data received from the monitored channel in the 

8 storage. 



M= 1 45. The system of claim 44, wherein the monitoring step comprises the steps 

I 2 of: 

ji 3 joining a channel; 

fU 4 waiting a time delay; and 

5 leaving the channel. 

1 46. The system of claim 45, wherein the monitoring step further comprises the 

2 step of: 

3 simulating user activities. 
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1 47. The system of claim 46, wherein the simulating step comprises the step 

2 of: 

3 transmitting a message to the channel. 

1 48. The system of claim 44, wherein the Internet Relay Chat client is further 

2 operable to scan the received data to detect a computer malware. 

1 49. The system of claim 48, wherein the computer malware comprises at least 

i« 2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 50. The system of claim 44, further comprising: 

2 malware analysis software operable to analyze the stored and logged data 

3 to detect a computer malware. 

1 51. The system of claim 50, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 

1 52. The system of claim 50, wherein the Internet Relay Chat client is further 

2 operable to scan the received data to detect a computer malware. 
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53. The system of claim 51, wherein the computer malware comprises at least 
one of a computer virus, a computer worm, or a computer Trojan horse program. 



1 54. The system of claim 50, wherein the monitoring step comprises the steps 

2 of: 

3 joining a channel; 

4 waiting a time delay; and 

5 leaving the channel. 

1 55. The system of claim 54, wherein the monitoring step further comprises the 

2 step of: 

3 simulating user activities. 

1 56. The system of claim 55, wherein the simulating step comprises the step 

2 of: 

3 transmitting a message to the channel. 

1 57. The system of claim 56, wherein the computer malware comprises at least 

2 one of a computer virus, a computer worm, or a computer Trojan horse program. 
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